Looming Incident Reporting Mandates: Who Needs To Care

A new federal cyber incident reporting law broadly applicable to critical infrastructure organizations is nearing completion, and companies should consider preparing now for these new regulatory requirements. Experience with other federal cybersecurity reporting obligations demonstrates that reporting requirements are most effective—and least disruptive—when they are incorporated into existing governance, incident response, and crisis-management processes well before a cyber incident makes them legal and operational obligations.

Background:

The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) has been developing new cyber incident reporting regulations under the Cybersecurity Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) that require critical infrastructure (CI) companies to report a significant cyber incident to CISA within 72 hours and to report making a ransom payment within 24 hours. Once finalized, the rules will establish mandatory reporting obligations for “covered entities” (which includes a broad array of sectors and companies) and are expected to introduce new timelines, thresholds, and compliance considerations.

Who May Be Covered?

CISA proposes a broad approach to defining “covered entities” subject to the rule and relies on the descriptions that appear in prior DHS sector specific plans, many of which are from 2015 and were not focused on defining the sectors for regulatory purposes.

• The proposal has some size-based exclusions for smaller entities that would not apply if an entity meets the sector-based criteria.
• An entity that meets the sector-based criteria would be covered, even if they are not part of that sector. 
• Some companies would fall under multiple sectors.

It is not clear yet how CISA may redefine “covered entity” in response to the concerns raised by industry and Congress concerning the breadth of the 2024 Notice of Proposed Rulemaking (NPRM). When the final rule is promulgated, organizations will need to carefully review these definitions, in coordination with legal counsel, to determine potential applicability.

What Should Companies Do to Prepare?

In preparation for CIRCIA, companies may consider focusing now on organizational preparedness rather than on the specific reporting thresholds or contents that may appear in the final rule. While some aspects of the final rule may change from the NPRM, the CIRCIA statute establishes many parameters around reporting from which CISA is unlikely to depart.

Review and Update Policies and Procedures

Many organizations already have internal policies and processes for assessing the severity or impact of a cybersecurity event or incident within their cybersecurity teams and functions. The key to successful regulatory reporting is to integrate legal counsel into those assessments and workflows so that an assessment of an event is based on a shared understanding of the facts as part of a privileged internal investigation.

Companies anticipating CIRCIA may want to:

• Put policies and procedures in place that address CIRCIA incident reporting within 72 hours and ransom payment reporting within 24 hours.
• Incorporate CIRCIA-related decision making into the company's existing incident response framework.
• Evaluate where reportable information is stored to simplify reporting workflows.

Additionally, while CIRCIA mandates incident reporting for “covered entities” in CI, other regulatory reporting requirements remain in effect. For instance, cleared defense contractors would also be required to report cyber incidents to the Department of War within 72 hours under the Defense Federal Acquisition Regulations and publicly traded companies would still be required to file a disclosure with the Securities and Exchange Commission within 4 days of determining an incident had a material impact.

What May Be Required When Making a CIRCIA Report

While the final rules are not out yet, under the NPRM, during the 72-hour period, the company will need to:

• activate its incident response plan;
• have designated cybersecurity response personnel assess the incident and work with the legal team to prepare the description of the covered cyber incident, which depending on the contents of the final rule, may include:
  • Function of affected networks, devices, and information systems;
  • Disruption of business or industrial operations;
  • Timeline of the incident;
  • Description of vulnerabilities exploited;
  • Tactics, techniques, and procedures used by the threat actor;
  • Description of the unauthorized access (if any);
  • Samples of malicious code;
  • Indicators of compromise;
  • Mitigation and response activities; and
  • Identification of law enforcement agency engaged in response.

The path to incorporating the necessary policies and functions to comply with the final rule will depend on a company’s current incident reporting obligations and whether it has an existing incident reporting compliance structure.

Post-Reporting Obligations

Supplemental Reports. Under CIRCIA, covered entities that have reported an incident should be prepared to file a supplemental report if new information becomes available. The requirement for supplemental reports remains in effect until the covered entity notifies CISA that the incident “has concluded and has been fully mitigated and resolved.”

Data Preservation. Under CIRCIA, covered entities are required to preserve data relevant to the covered cyber incident or ransom payment. Under the proposal, the expansive scope of data preservation and the requirement to preserve the data for no less than two years has been objected to by stakeholders and may be modified under the final rule. However, companies should be prepared to store data related to the incident and have it readily accessible in response to a lawful government request.

Navigating Enforcement Risks

CIRCIA provides CISA with a series of enforcement tools to address noncompliance in the form of a failure to report a covered cyber incident or ransom payment, a failure to respond to a request for information (RFI), and a failure to respond to a subpoena. CIRCIA also provides for civil enforcement of a subpoena by the Department of Justice (DOJ), criminal prosecution by DOJ, and acquisition suspension and debarment for covered entities that are government contractors.

Policy and Process. Organizations preparing for the final rule should consider developing a policy and process for responding to an RFI or subpoena related to an allegedly reportable cybersecurity incident. Such a policy and process could be incorporated into the company’s incident response framework and include legal counsel.

Timing Considerations

The 2024 CISA NPRM received substantial industry and even congressional criticism. The agency missed a statutory deadline of October 2025 to finalize the rulemaking—due to industry pushback over the breadth of the definitions, congressional appropriations lapses, and internal staffing reductions.

CISA offered an opportunity for additional public comment at virtual “Town Hall” sessions in June 2026 and through submission of written materials for CISA’s consideration as the agency drafts the final regulations. Some of the key issues that companies and associations addressed in the Town Hall sessions and previous comments filed with CISA include:

• Limiting the scope of what entities have to report incidents as covered entities—the NPRM took a broad approach and estimated over 300,000 organizations might be covered;
• Ensuring that only cyber incidents that cause significant impacts are reported;
• Limiting the breadth and depth of information that must be provided to CISA in an incident report—the NPRM proposed a voluminous set of information, some of which is unnecessary and potentially sensitive or even privileged (such as which response service providers a victim company has engaged); and
• Pushing CISA to aggressively work to harmonize its regime so that companies already subject to a cyber incident reporting requirement from a sector-specific agency (Sector Risk Management Agency), sectorial regulator or other federal agency, do not have to make multiple reports (see our blog post from last year on harmonization opportunities).

Most recently, CISA released a revised regulatory agenda indicating that it plans to finalize the CIRCIA rule by September 2026, but some experts anticipate the rule will be published in late 2026.

Under CIRCIA, the incident-reporting requirements become effective on the date established in CISA’s final rule. As a major rule, the effective date for the final rule will be at least 60 days after it is published in the Federal Register allowing for congressional review pursuant to the Congressional Review Act.

Next Steps

Wiley can provide tailored, industry-specific guidance on how to get ready for new legal and regulatory obligations as well as what to expect if the rules are ultimately adopted as proposed. We have helped many companies with cyber incident response and planning, including for CIRCIA and other cyber incident reporting regimes (Department of Defense, Transportation Security Administration, Department of Commerce Bureau of Industry and Security, FCC, NYDFS, California, and more).